what does this mean if ($query->param($key) =~ /([^\/\\]+)$/) { # is this removing spaces ??

The square brackets enclose a character class. The first character in that class is a caret, which negates the class. Each initial backslash escapes the following character. The plus sign matches one or more. The parentheses store whatever is matched. The dollar matches the end of the line. Putting it all together, "if parameter ends with one or more non-slashes, give me those non-slashes in $1.

This is matching only - no substitution.

and next if ($key !~ /^filetoupload_(\d+)$/); especially (\d+)$/ mean

\d matches a digit. Here, caret matches the start of the string. Everything else is described above. Putting it together, if $key starts with "filetoupload_" and ends with digits, give me those digits in $1.